Case data visualization application

ABSTRACT

A case data visualization application is provided that, when executed on a device, allows a user to visualize a chronology of events associated with a case, view a summary of one or more supporting details of an event, and drill-down to view specific case data of each supporting detail of an event. Thus, the case data visualization application provides a way of collecting, organizing, visualizing, and sharing data associated with a case. Furthermore, the case data visualization application allow a plurality of users to collaborate on the case, and synchronizes a plurality of supporting details created by a plurality of users that are associated with an event.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part application of U.S.application Ser. No. 13/517,814, filed on Jun. 14, 2012, and which isherein incorporated by reference in its entirety.

BACKGROUND

1. Field

Certain embodiments of the invention relate generally to computersystems. More specifically, certain embodiments of the present inventionrelate to computer systems that provide one or more softwareapplications utilized in collecting, organization, visualizing, andsharing of data.

2. Description of the Related Art

Individuals across a range of fields, such as law enforcement,scientific research, historical research, litigation and insurance, arerequired to collect and organize a significant amount of data as part oftheir day-to-day workloads. Such individuals are generally required toorganize and present this collected data (such as presenting a caseagainst a defendant or presenting results of experiments to colleagues).However, it is generally difficult to build a logical, time-orientednarrative based on the collected data, as the collected data isgenerally from numerous different sources, and generally in numerousdifferent formats. Furthermore, conventional tools are generally not setup to facilitate creating such a narrative. For example, enterpriseresource planning (ERP) case management software is generally toounwieldy to facilitate a logical, time-oriented narrative. Furthermore,the use of ERP case management software can raise issues as to theportability of sensitive data, or the portability of data that is tiedto the ERP case management software, and not easily transferred intoanother format.

SUMMARY

According to an embodiment of the invention, a method includesdisplaying a timeline that includes one or more events associated with acase, where the one or more events are displayed within the timeline ina chronological order, and where at least one event includes case data.The method further includes creating a new event that is associated withthe case. The method further includes receiving one or more files, whereat least one file includes new case data. The method further includesencapsulating the one or more files within a case file. The methodfurther includes displaying the new event within the timeline, where thedisplayed new event includes a link to the case file, and where the linkto the case file causes the new case data to be displayed within thetimeline. The method may further include creating a project, for exampleusing a project editor user interface, where the project may include asnapshot of the timeline, and exporting the project to a browser-basedpresentation file or a report file.

According to another embodiment, an apparatus includes a memoryconfigured to store a case data visualization module. The apparatusfurther includes a processor configured to execute the case datavisualization module stored on the memory. The processor is furtherconfigured, when executing the case data visualization module stored onthe memory, to, display a timeline that includes one or more eventsassociated with a case, where the one or more events are displayedwithin the timeline in a chronological order, and where at least oneevent includes case data. The processor is further configured, whenexecuting the case data visualization module stored on the memory, to,create a new event that is associated with the case. The processor isfurther configured, when executing the case data visualization modulestored on the memory, to, receive one or more files, where at least onefile includes new case data. The processor is further configured, whenexecuting the case data visualization module stored on the memory, to,encapsulate the one or more files within a case file. The processor isfurther configured, when executing the case data visualization modulestored on the memory, to, display the new event within the timeline,where the displayed new event includes a link to the case file, andwherein the link to the case file causes the new case data to bedisplayed within the timeline. The processor may be further configuredto create a project, for example using a project editor user interface,where the project may include a snapshot of the timeline, and to exportthe project to a browser-based presentation file or a report file.

According to another embodiment, a non-transitory computer-readablemedium includes a computer program stored thereon that, when executed bya processor, causes the processor to implement a method. The methodincludes displaying a timeline that includes one or more eventsassociated with a case, where the one or more events are displayedwithin the timeline in a chronological order, and where at least oneevent includes case data. The method further includes creating a newevent that is associated with the case. The method further includesreceiving one or more files, where at least one file includes new casedata. The method further includes encapsulating the one or more fileswithin a case file. The method further includes displaying the new eventwithin the timeline, where the displayed new event includes a link tothe case file, and where the link to the case file causes the new casedata to be displayed within the timeline.

According to another embodiment of the invention, a method includesreceiving a first set of case data associated with a case, where thefirst set of case data includes a first set of events associated withthe case. The method further includes comparing the first set of casedata with a second set of case data associated with the case, where thesecond set of case data includes a second set of events associated withthe case. The method further includes reconciling one or moredifferences between the first set of case data with the second set ofcase data.

According to another embodiment, an apparatus includes a memoryconfigured to store a case data visualization module. The apparatusfurther includes a processor configured to execute the case datavisualization module stored on the memory. The processor is furtherconfigured, when executing the case data visualization module stored onthe memory, to, receive a first set of case data associated with a case,where the first set of case data includes a first set of eventsassociated with the case. The processor is further configured, whenexecuting the case data visualization module stored on the memory, to,compare the first set of case data with a second set of case dataassociated with the case, where the second set of case data includes asecond set of events associated with the case. The processor is furtherconfigured, when executing the case data visualization module stored onthe memory, to reconcile one or more differences between the first setof case data with the second set of case data.

According to another embodiment, a non-transitory computer-readablemedium includes a computer program stored thereon that, when executed bya processor, causes the processor to implement a method. The methodincludes receiving a first set of case data associated with a case,where the first set of case data includes a first set of eventsassociated with the case. The method further includes comparing thefirst set of case data with a second set of case data associated withthe case, where the second set of case data includes a second set ofevents associated with the case. The method further includes reconcilingone or more differences between the first set of case data with thesecond set of case data.

BRIEF DESCRIPTION OF THE DRAWINGS

Further embodiments, details, advantages, and modifications of thepresent invention will become apparent from the following detaileddescription of the preferred embodiments, which is to be taken inconjunction with the accompanying drawings, wherein:

FIG. 1 illustrates a block diagram of an apparatus in accordance with anembodiment of the invention.

FIG. 2 illustrates a block diagram of a system in accordance with anembodiment of the invention.

FIG. 3 illustrates a block diagram of a case data visualizationapplication in a client format in accordance with an embodiment of theinvention.

FIG. 4 illustrates a block diagram of a case data visualizationapplication in a reader format in accordance with an embodiment of theinvention.

FIG. 5 illustrates an example user interface of a case datavisualization module, according to an embodiment of the invention.

FIG. 6 illustrates an example file library user interface of a case datavisualization module, according to an embodiment of the invention.

FIG. 7 illustrates a block diagram of a case data visualizationapplication in a mobile format in accordance with an embodiment of theinvention.

FIG. 8 illustrates a block diagram of a case data visualizationapplication in a server format in accordance with an embodiment of theinvention.

FIG. 9 illustrates a method according to an embodiment of the invention.

FIG. 10 illustrates another method, according to an embodiment of theinvention.

FIG. 11 illustrates an example user interface of a case datavisualization module, according to an embodiment of the invention.

FIG. 12 illustrates a method, according to another embodiment of theinvention.

DETAILED DESCRIPTION

It will be readily understood that the components of the presentinvention, as generally described and illustrated in the figures herein,may be arranged and designed in a wide variety of differentconfigurations. Thus, the following detailed description of theembodiments of a method, apparatus, system, and computer-readablemedium, as represented in the attached figures, is not intended to limitthe scope of the invention as claimed, but is merely representative ofselected embodiments of the invention.

The features, structures, or characteristics of the invention describedthroughout this specification may be combined in any suitable manner inone or more embodiments. For example, the usage of the phrases “certainembodiments,” “some embodiments,” or other similar language, throughoutthis specification refers to the fact that a particular feature,structure, or characteristic described in connection with the embodimentmay be included in at least one embodiment of the present invention.Thus, appearances of the phrases “in certain embodiments,” “in someembodiments,” “in other embodiments,” or other similar language,throughout this specification do not necessarily all refer to the samegroup of embodiments, and the described features, structures, orcharacteristics may be combined in any suitable manner in one or moreembodiments.

DEFINITIONS

A “computer,” as understood by one of ordinary skill in the art, is anyprogrammable machine that receives input, automatically stores andmanipulates data, and provides output. A “physical machine” or “physicalcomputer” is a hardware implementation of a machine or computer, wherethe machine or computer includes a hardware component. A “virtualmachine” or “virtual computer” is a software implementation of a machineor computer that executes programs like a physical machine or computer,but where the software implementation does not include a hardwarecomponent outside of the physical machine or computer that the virtualmachine or computer executes upon.

A “computer program” is any sequence of instructions written to performa specific task on a computer, and has an executable form that acomputer (typically through the use of a processor) can use to executethe instructions. A “computer module,” “software module,” or “module” isany computer program, or a portion thereof, that encapsulates relatedfunctions. A “computer application,” “software application,” or“application” is any collection of computer programs and/or modules. A“computer network” or “network” is any collection of computersinterconnected by communication channels that facilitate communicationamong the computers. A “file” is a resource that stores data that can beaccessed by a computer program that is executed within the computer. A“case” is an actual event, situation, or fact, such as a legalproceeding (such as a prosecution of a criminal defendant), a medicalproceeding involving an instance of a specific condition or set ofsymptoms and a medical examination of the condition or symptoms, or aunit of work for a specific profession.

Case Data Visualization Application

According to an embodiment of the invention, a software application(identified as a “case data visualization application”) can be providedthat, when executed on a device, allows a user to visualize a chronologyof events associated with a case (such as a prosecution of a criminaldefendant, a medical examination of a specific condition, or set ofsymptoms, or a unit of work for a specific procession), view a summaryof one or more supporting details (such as documents or files) of anevent, and drill-down to view specific case data of each supportingdetail of an event, in one cohesive software application. Thus, the casedata visualization application can provide a way of collecting,organizing, visualizing, and sharing data associated with a case. Thecase data visualization application can provide a framework that allowsfor multiple view types for visualizing a case, including a timelineview of the case, a spatial map view of the case, a tabular grid view ofthe case, and a relational link chart view of the case. Furthermore, thecase data visualization application can allow a plurality of users tocollaborate on the case, and can synchronize a plurality of supportingdetails created by a plurality of users that are associated with anevent. The case data visualization application can be implemented on anydevice, such as a client or server.

FIG. 1 illustrates a block diagram of an apparatus 100 in accordancewith an embodiment of the invention. As is described below in greaterdetail, in certain embodiments, apparatus 100 can be a client. As isalso described below in greater detail, in other embodiments, apparatus100 can be a server.

According to the embodiment, apparatus 100 includes a bus 105 or othercommunications mechanism for communicating information betweencomponents of apparatus 100. Apparatus 100 also includes a processor110, operatively coupled to bus 105, for processing information andexecuting instructions or operations. Processor 110 may be any type ofgeneral or specific purpose processor. Apparatus 100 further includes amemory 115 for storing information and instructions to be executed byprocessor 110. Memory 115 can include any combination of random accessmemory (RAM), read only memory (ROM), static storage such as a magneticor optical disk, or any other type of machine or computer-readablemedium. Apparatus 100 further includes a communication device 120, suchas a network interface card or other communications interface, toprovide access to a network. As a result, a user may interface withapparatus 100 directly, or remotely through a network or any othermethod.

A computer-readable medium may be any available medium that can beaccessed by processor 110. A computer-readable medium may include both avolatile and nonvolatile medium, a removable and non-removable medium,and a storage medium. A storage medium may include RAM, flash memory,ROM, erasable programmable read-only memory (EPROM), electricallyerasable programmable read-only memory (EEPROM), registers, hard disk, aremovable disk, a compact disk read-only memory (CD-ROM), or any otherform of storage medium known in the art.

Processor 110 can also be operatively coupled via bus 105 to a display125, such as a Liquid Crystal Display (LCD). Display 125 can displayinformation to the user. A keyboard 130 and a cursor control device 135,such as a computer mouse, can also be operatively coupled to bus 105 toenable the user to interface with apparatus 100.

Processor 110 can also be operatively coupled via bus 105 to a database140. Database 140 can store data in an integrated collection oflogically-related records or files. Database 140 can be an operationaldatabase, an analytical database, a data warehouse, a distributeddatabase, an end-user database, an external database, a navigationaldatabase, an in-memory database, a document-oriented database, areal-time database, a relational database, an object-oriented database,a NoSQL database, or any other database known in the art. In certainembodiments, where apparatus 100 is a client, database 140 can be anembedded relational database, such as a SQLite database. In certainembodiments, where apparatus 100 is a server, database 140 can be aNoSQL database, such as a MongoDB database.

According to one embodiment, memory 115 can store software modules thatmay provide functionality when executed by processor 110. The modulescan include case data visualization module 150. Case data visualizationmodule 150 can provide a case data visualization application that cancollect, organize, synchronize, and display case data, as is describedbelow in greater detail. In certain embodiments, case data visualizationmodule 150 can comprise a plurality of modules that each providespecific individual functionality for collecting, organizing,synchronizing, and displaying case data.

According to the embodiment, memory 115 can also store operating system160. Operating system 160 can provide an operating system functionalityfor apparatus 100. In one embodiment, apparatus 100 can also be part ofa larger system. Thus, memory 115 can also store one or more additionalapplications 170 to include additional functionality for an overallsystem that apparatus 100 can be a part of.

FIG. 2 illustrates a block diagram of a system 200, according to anembodiment of the invention. System 200 includes server 210. Server 210can be any computer system or software application that provides aservice. Server 210 can be any type of server configured to synchronizecase data, as is described below in greater detail, where examples ofserver 210 include any kind of application server, or any kind of webserver. In certain embodiments, server 210 can be identical to apparatus100 of FIG. 1. In alternate embodiments, server 210 can represent adistributed software-as-a-service (SaaS) solution that comprises aplurality of servers. In any of these embodiments, server 210 canutilize a case data visualization module (such as case datavisualization module 150 of FIG. 1) to provide a case data visualizationapplication that can synchronize case data, as is described below ingreater detail.

System 200 also includes one or more clients, such as personal computerclient 211, laptop client 212, tablet device client 213, personaldigital assistant (PDA) client 214, and mobile device client 215, wherea client can be can be any computer system or software application thataccesses a service on a remote computer system, such as a personalcomputer, a laptop computer, a tablet computer, a PDA, and a mobiledevice. A client, such as personal computer client 211, laptop client212, tablet device client 213, personal digital assistant (PDA) client214, and mobile device client 215, can be configured to collect,organize, and display case data, as is described below in greaterdetail. In certain embodiments, a client, such as personal computerclient 211, laptop client 212, tablet device client 213, PDA client 214,or mobile device client 215, can be identical to apparatus 100 ofFIG. 1. In these embodiments, the client can utilize a case datavisualization module (such as case data visualization module 150 ofFIG. 1) to provide a case data visualization application that cancollect, organize, and display case data, as is described below ingreater detail. Furthermore, the client can utilize a case datavisualization module (such as case data visualization module 150 ofFIG. 1) to collect case data, encrypt the collected case data, andtransmit the encrypted case data to another client, as is also describedbelow in great detail.

One of ordinary skill in the art would readily understand that system200 is an example configuration of a system according to an embodiment,and that, in other alternate embodiments, a system may have a differentconfiguration. For example, a system may have any number of servers, andany number of clients, where each client may by any type of client, suchas the types of client illustrated in FIG. 2. Furthermore, a system mayalso have additional types of devices not illustrated in FIG. 2.

In certain embodiments, a case data visualization module, such as (suchas case data visualization module 150 of FIG. 1) can provide a case datavisualization application that can be one of four formats: a clientformat, a reader format, a mobile format, and a server format. The fourformats of a case data visualization application are further describedin greater detail.

In certain embodiments, where the case data visualization application isa client format, the case data visualization application can beimplemented on any type of client device, such as the client devicesillustrated in FIG. 2 (i.e., personal computer client 211, laptop client212, tablet device client 213, PDA client 214, and mobile device client215). The case data visualization application can also be implemented onany computer platform, such as Microsoft Windows®, Apple Mac OS®, andLinux.

FIG. 3 illustrates a block diagram of a case data visualizationapplication in a client format in accordance with an embodiment of theinvention. According to the embodiment, a device 300 can include a casedata visualization application 310 that is a client format, where thecase data visualization application 310 is implemented on device 300.

According to the embodiment, case data visualization application 310 canencapsulate case data (such as images, scanned documents,visualizations, and other files) associated with a case. Such a case caninclude a criminal prosecution of a defendant, for example. As anotherexample, such a case can include the provision of health care to apatient, the provision of legal services to a client, or any unit ofwork for a given profession. Cases are not limited to these examples,and can include any type of case that generates case data. Case datavisualization application 310 can encapsulate the case data into a casefile. A case file is a file that is associated with a case, that has aspecifically defined format, and that includes case data. All case filesthat can be associated with a case can each have the same specificallydefined format, and thus, all case files can have a universal format. Inone embodiment, the case files can have a SQLite format.

In certain embodiments, the case data can be stored in one or morefiles, and case data visualization application 310 can receive the oneor more files and encapsulate the one or more files into the case file.For example, case data visualization application 310 can display userinterface 320 that allows a user to select one or more files that arestored on device 300 (where device 300 also stores case datavisualization application 310). In certain embodiments, user interface320 also allows the user to select a folder that is stored on device300, where the folder includes one or more files.

In certain embodiments, case data visualization application 310 canautomatically forensically hash each file of the one or more filesbefore encapsulating each file into the case file. As one of ordinaryskill in the art would readily appreciate, forensically hashing refersto hashing data to produce a digital signature and embedding the digitalsignature within the data to verify that the data has not been altered.The forensic hashes can be generated using a hashing algorithm (such asa MD5 message-digest algorithm (“MD5”)). According to these embodiments,each file is forensically hashed upon collection. In certainembodiments, case data visualization application 310 can determine thata received file is identical to a file that has already been receivedand encapsulated into a case file. In these embodiments, rather thanencapsulating the received file into the case file a second time, casedata visualization application 310 can create metadata that referencesthe file that has already been received, and can encapsulate themetadata, rather than the received file, within the case file. Incertain embodiments, case data visualization application 310 can encryptthe case file. Also, in certain embodiments, case data visualizationapplication 310 can store the case file within a database that is storedon device 300 (where device 300 also stores case data visualizationapplication 310). In certain embodiments, the database is a SQLitedatabase.

After receiving the one or more files, and encapsulating them into thecase file, case data visualization application 310 can then generate atimeline visualization of the case data, and display the timelinevisualization of the case data within user interface 320. An example ofsuch a user interface is described in further detail in relation to FIG.5.

In certain embodiments, a user can create a new event within userinterface 320 of case data visualization application 310 by “clicking”on the timeline visualization. According to the embodiments, an “event”is a representation of case data associated with a point in time, or aduration is time, where the event can be visually represented withinuser interface 320. An event can take on one of many visualrepresentations, including a block or a milestone. The user can alsoassociate summary information to the event, such as a date and/or time,or a title, by entering the summary information within user interface320. The user can also associate one or more files to the event, wherethe one or more files each include case data, by selecting the one ormore files (or a folder that contains the one or more files) that can bedisplayed within user interface 320. In response to the selection, casedata visualization application 310 can then receive the one or morefiles and encapsulate the one or more files within a case file.

In certain embodiments, an event can be associated with one or moretags. A tag is a short word or phrase that can be assigned to an eventthat identifies a category that the event is associated with. Accordingto these embodiments, tagging can be the primary way to organize the oneor more events associated with a case. In accordance with theembodiment, an event can have one or more tags associated with it.Because an event can have more than one tag associated with it, anevent, and the case data contained within the event, can be organizedinto multiple categories. One type of tag is a predefined tag. This typeof tag can be created by a system administrator of case datavisualization application 310, and the text of the predefined tag can bedefined when the predefined tag is created. A user can use a predefinedtag in order to provide a standard way of categorizing events. Anothertype of tag is a regular tag. This type of tag can be created by a user,and the user can define the text of the regular tag when the usercreates the tag. A user can use a regular tag in order to customize howthe user indexes one or more events.

In certain embodiments, an event can be full-text indexed. As one ofordinary skill in the art would readily appreciate, full-text indexingrefers to creating one or more indexes for case data that contains text,where each index of the one or more indexes corresponds to a wordcontained within the text, so that the case data is searchable. Thus, byfull-text indexing an event, one or more indexes can be created for thecase data included within the event, where the case data contains text.

In certain embodiments, case data visualization application 310 canfilter a display of the one or more events associated with a case. Casedata visualization application 310 can filter the display of the one ormore events based on one or more tags, where the user can select one ormore tags, and case data visualization application 310 can display onlythe events that are associated with at least one tag. Case datavisualization application 310 can filter the one or more events based onone or more full-text indexes, where a user can enter one or more words,and case data visualization application 310 can display only the eventsthat contain at least one word.

According to certain embodiments, case data visualization application310 can facilitate coordination of case data with another case datavisualization application. In general, there may be specific barriers totwo or more organizations collaborating. For example, a law enforcementorganization may have data related to a grand jury proceeding thatcannot be shared with outside organizations. However, a private sectororganization may work with the law enforcement organization, and mayhave data that is related to the grand jury proceeding, and that ismutually beneficial to both organizations. Although the private sectororganization may be willing to share its data with the law enforcementorganization, there may be legal and bureaucratic reasons why theorganization's data cannot be commingled into a single database. Casedata visualization application 310 can facilitate such coordinationwithout commingling the two organizations' data. According to theembodiments, a case data visualization application for a firstorganization (such as case data visualization application 310) candistill criteria (such as a set of search terms and/or tags) into acriteria file. The criteria file can be loaded into a case datavisualization application for a second organization. The case datavisualization application for the second organization can correlatecriteria distilled within the criteria file with case data stored withinthe case data visualization application for the second application. Thecorrelation can produce one or more correlation results. Correlationresults from the correlation can be filtered by the case datavisualization for the second organization to remove any personal orconfidential information. The filtered correlation results can bedisplayed within a user interface or stored within a file. For example,the filtered correlation results could include a list of one or morecontacts, where each contact is associated with case data, but the casedata is filtered, so that only contact information is returned.

In certain embodiments, where the case data visualization application isa reader format, the case data visualization application can disable theability to edit the case data.

FIG. 4 illustrates a block diagram of a case data visualizationapplication in a reader format in accordance with an embodiment of theinvention. According to the embodiment, a device 400 can include a casedata visualization application 410 that is a reader format, where thecase data visualization application 410 is implemented on device 400.Case data visualization application 410 can perform the functionalitydescribed in relation to case data visualization application 310, butcase visualization application 410 can disable the ability to edit casedata. For example, case data visualization application 410 can disablethe ability to create new events. As another example, case datavisualization application 410 can disable the ability to add one or morefiles to case data visualization application 410 to be encapsulated intoa case file. In certain embodiments, editing features normally displayedwithin user interface 420 (such as a button for creating a new event oradding one or more files) are “grayed out,” (i.e., are displayed with agray field over them) and do not provide any functionality to a user(i.e., cannot be accessed by the user to perform any functionality). Inother embodiments, the editing features normally displayed within userinterface 420 are removed. In this manner, case data visualizationapplication 410 can be distributed to third parties, without any risk ofcontamination of the case data stored within case data visualizationapplication 410.

FIG. 5 illustrates an example user interface 500 of a case datavisualization module, according to an embodiment of the invention. Inone embodiment of the invention, user interface 500 is a default viewpresented to a user upon initiation of the case data visualizationapplication.

According to the illustrated embodiment of FIG. 5, user interface 500includes detail band 510. Detail band 510 displays case data associatedwith a case. More specifically, according to an embodiment, detail band510 displays a view, such as a view of a timeline (i.e., timeline view),where one or more events that are associated with the case are displayedalong the timeline, where each event of the one or more events includescase data. In one embodiment, detail band 510 only displays a portion ofthe timeline, and thus, only displays a portion of the one or moreevents. According to the embodiment, the portion of the timeline that isdisplayed within detail band 510 is determined by focus window 521 oftime band navigator 520, as is described below in greater detail.

Furthermore, according to the embodiment, the portion of the timelinethat is displayed within detail band 510 can be adjusted by a user,through the user “clicking” within detail band 510 and “scrolling” in ahorizontal direction (with the computer mouse, for example) to a newposition within the timeline. As another example, a user can adjust theportion of the timeline that is displayed within detail band 510 by“touching” within detail band 510 where detail band is displayed on atouchscreen and “swiping” in a horizontal direction (with a finger forexample) to a new position within the timeline. Through the “scrolling”in the horizontal direction to a new position within the timeline,within detail band 510, detail band 510 adjusts the timeline view sothat a portion of the timeline that corresponds to the new position isdisplayed within detail band 510. The “scrolling” in the horizontaldirection, within detail band 510, also causes time band navigator 520to adjust the position of focus window 521 displayed within time bandnavigator 520 to correspond to the new position, as is also describedbelow in greater detail. In one embodiment, when a user “clicks” withindetail band 510 and “scrolls” in a horizontal direction, detail band 510displays a date and/or time that corresponds to a point within detailband 510. In one embodiment, this point is the center point of detailband 510.

In the illustrated embodiment of FIG. 5, detail band 510 displays tenevents 511 associated with a case (entitled “Event #1,” “Event #2,”“Event #3,” “Event #4,” “Event #5,” “Event #6,” “Event #7,” “Event #8,”“Event #9,” and “Event #10,” respectively). One of ordinary skill in theart would readily appreciate that this is merely an example embodiment,and that in alternate embodiments, detail band 510 can display anynumber of events, where each event can be of any type. In theillustrated embodiment, each event is also associated with a specificdate and/or time. However, in alternate embodiments, an event can beassociated with a span of time, rather than a specific date and/or time.According to the illustrated embodiment, detail band 510 displays events511 using a “stacking algorithm.” A stacking algorithm is a displayalgorithm that generally displays events within the timeline that isdisplayed within detail band 510 in a horizontal direction, from left toright, based on a date and/or time corresponding to the event. Accordingto the stacking algorithm, a subsequent event is displayed to the rightof a preceding event in a horizontal direction, when the duration amountbetween the preceding event and the subsequent event is greater than orequal to a predetermined amount. This predetermined amount can bedetermined based on the screen size of detail band 510, and candynamically be adjusted when the screen size of detail band 510 isadjusted. However, when the duration amount between the subsequent eventand the preceding event is less than a predetermined amount, thestacking algorithm not only displays the subsequent event to the rightof the preceding event in a horizontal direction, but also displays thesubsequent event above the preceding event in a vertical direction. Inother words, the stacking algorithm “stacks” the subsequent event on topof the preceding event vertically as well as horizontally.

An example of a stacking algorithm is illustrated in FIG. 5. Accordingto the illustrated embodiment, detail band 510 displays events 511 usinga stacking algorithm. According to the stacking algorithm, events 511entitled “Event #1,” “Event #2,” “Event #3,” and “Event 4,” are“stacked” vertically, as well as horizontally, as the duration amountbetween the events are less than the predetermined amount. In contrast,event 511 entitled “Event #5” is not “stacked” vertically upon event 511entitled “Event #4” because the duration amount between the events isgreater than or equal to the predetermined amount. Instead, event 511entitled “Event #5” is merely displayed to the right of event 511entitled “Event #4,” in a horizontal direction. Similarly, events 511entitled “Event #6,” and “Event #7” are stacked vertically, as well ashorizontally, and events 511 entitled “Event #8,” “Event #9,” and “Event#10,” are stacked vertically, as well as horizontally, whereas event 511entitled “Event #8” is merely displayed to the right of events 511entitled “Event #6” and “Event #7,” in an horizontal direction. Asillustrated in FIG. 5, the stacking algorithm displays a subsequentevent at the bottom of the timeline when the duration amount between thepreceding event and the subsequent event is greater than or equal to apredetermined amount, no matter where the preceding event was displayedwith respect to the timeline.

According to an embodiment, detail band 510 also displays one or moretime increments that the timeline can be divided into. In theillustrated embodiment of FIG. 5, detail band 510 displays timeincrements 512, where each time increment 512 represents a day. One ofordinary skill in the art would readily appreciate that time increments512 are only examples of time increments, and that a time increment canbe any duration of time, such as a second, a minute, an hour, a day, aweek, a month, and a year. Furthermore, in one embodiment, timeincrements 512 are determined by detail band 510 based on a size of adisplay within detail band 510, and detail band 510 can dynamicallyadjust time increments 512 (for example, adjust time increments 512 fromdays to hours), based on a size adjustment of the display within detailband 510. A size adjustment of the display within detail band 510 isdescribed below in greater detail.

In one embodiment, by “hovering” (for example, with a computer mouse)over an event displayed within detail band 510, such as event 511,detail band 510 displays a “tooltip” that includes case data associatedwith the event. In one embodiment, the case data includes a date and/ortime of the event. In another embodiment, the case data also includes alink to a case file associated with the event. In the illustratedembodiment of FIG. 5, by hovering over event 511 entitled “Event #10,”detail band 510 displays tooltip 513 associated with event 511.According to the illustrated embodiment, tooltip 513 includes a date andtime of event 511 (i.e., “Thurs, June 26, 20:20:20 GMT-0700 2011).

In an embodiment, a user can “click” on an event, such as event 511illustrated in FIG. 5, to highlight the event. According to theembodiment, a user can navigate to a subsequent event. In one example, auser can navigate to the subsequent event by “clicking” on a button (notshown in FIG. 5) displayed within user interface 500. According to anembodiment, the user can also navigate to a preceding event. In oneexample, a user can navigate to the preceding event by “clicking” onanother button (also not shown in FIG. 5). In one embodiment, thesubsequent event (or preceding event) is the first event that occursafter (or before) the highlighted event. In another embodiment, thesubsequent event (or preceding event) is a “context-specific” event, andthus, is the first event that occurs after (or before) the highlightedevent that also has an event type that is identical to the highlightedevent. In another embodiment, when a user highlights an event by“clicking” on the event, detail band 510 can identify that thehighlighted event is part of a sequence of events, and can alsohighlight the one or more events that are part of the sequence. Forexample, if a user highlights event 511, detail band 510 can identifythat event 511 is part of a plurality of events, and can also highlightthe other events.

According to the illustrated embodiment of FIG. 5, user interface 500also includes time band navigator 520. Time band navigator 520 displaysa complete range of a timeline. Time band navigator 520 includes focuswindow 521. Focus window 521 is a highlighted portion of time bandnavigator 520, and corresponds to a portion of the timeline that isdisplayed within detail band 510. Focus window 521 includes handles 522.Because focus window 521 corresponds to the portion of the timelinedisplayed within detail band 510, the left handle of handles 522corresponds to the left boundary of detail band 510, and the righthandle of handles 522 corresponds to the right boundary of detail band510. A user can “click” on a handle of handles 522 and “drag” the handlein a horizontal direction. By “dragging” one of handles 522 in ahorizontal direction, the user can increase or decrease the size offocus window 521. When the size of focus window 521 is increased ordecreased, detail band 510 dynamically updates its display to correspondto the size of focus window 521. In one embodiment, as previouslydescribed, one or more time increments displayed within detail band 510can be dynamically updated when the display of detail band 510 isdynamically updated (which can be based on an adjustment of the size offocus window 521).

Furthermore, according to the embodiment, a position of focus window 521within a timeline can be adjusted by a user, through the user “clicking”within focus window 521 and “scrolling” in a horizontal direction to anew position within the timeline. Through the “scrolling” in thehorizontal direction to a new position, within focus window 521, timeband navigator 520 adjusts the position of focus window 521 within thetimeline accordingly. The “scrolling” in the horizontal direction,within focus window 521, also causes detail band 510 to adjust thetimeline view so that a portion of the timeline that corresponds to thenew position is displayed within detail band 510. In one embodiment,when a user “clicks” within focus window 521 and “scrolls” in ahorizontal direction, detail band 510 displays a date and/or time thatcorresponds to a point within detail band 510. In one embodiment, thispoint is the center point of detail band 510. In another embodiment,when a user “clicks” within time band navigator 520, detail band 510adjusts the timeline view so that a portion of the timeline thatcorresponds to the position that the user “clicked” within time bandnavigator 520 is displayed within detail band 510.

In one embodiment, time band navigator 520 also displays one or morehistograms, where each histogram indicates a relative frequency ofevents within the timeline. In the illustrated embodiment of FIG. 5,time band navigator 520 displays histograms 523, where histograms 523each represent a relative frequency of events within the timeline.According to an embodiment, histograms 523 can be used to determinewhere to adjust a position of focus window 522.

According to the illustrated embodiment of FIG. 5, user interface 500also includes event detail 530. According to an embodiment of theinvention, when a user “clicks” on an event displayed within detail band510, event detail 530 displays associated details of the event. Incertain embodiments, such details includes a title of the event(displayed within event title 531), one or more tags associated with theevent (displayed within event tags 532), a summary associated with theevent (displayed within event summary 533), one or more dates associatedwith the event (displayed within event date(s) 534) and one or morefiles associated with the event (displayed within event files 535). Incertain embodiments, a user can associate one or more tags with theevent from within event tags 532, and can remove one or more associatedtags from within event tags 532. In certain embodiments, the one or moredates include a single date associated with the event, where the singledate is displayed within event date(s) 534. In other embodiments, theone or more dates include a start date associated with the event, and anend date associated with the event, where the start date and the enddate are each displayed within event date(s) 534. In certainembodiments, a user can “click” on one or more files displayed withinevent files 535, and user interface 500 will display the correspondingfile (not shown in FIG. 5).

According to the illustrated embodiment of FIG. 5, user interface 500also includes filter/navigation bar 540. Filter/navigation bar 540allows a user to navigate between, and filter, the one or more eventsdisplayed within user interface 500. For example, according to theembodiment, filter/navigation bar 540 includes navigation controls 541,search filter 542, tag filter 543, and file library 544. File library544 is described in greater detail in relation to FIG. 6.

Navigation controls 541 include controls for navigating betweendifferent events. Such controls can include a sidebar that displays asidebar within user interface 500 (not shown), where the sidebarincludes additional aspects of a case, such as a detailed overview ofthe case, author of a case, and case sharing information. Such controlscan also include a previous button and a next button that allow a userto navigate to a previous event and a next event within detail band 510,respectively. Such controls can also include a new event button thatallows a user to create a new event, and delete a current event,respectively.

Search filter 542 allows a user to enter text, such as one or morewords. According to an embodiment, a search filter can be applied sothat the transaction data visualization application only displays eventsthat are associated with the text (e.g., associated with at least oneword of the one or more words), or highlights associated events so theyare more prominently displayed on the timeline.

Tag filter 543 allows a user to select one or more tags. According to anembodiment, a tag filter can be applied so that the transaction datavisualization application only displays events that are associated withat least one of the selected tags.

In an embodiment, user interface 500 of a case data visualization modulemay include a document content search capability. For example, contentsof documents or files encapsulated into the case data visualizationapplication may be searched for certain keywords or text strings. In oneembodiment, search filter 542 may further include a search box whichallows a user to enter text to be searched from any of the files ordocument encapsulated into the case data visualization application. Forinstance, supported documents that may be searched include, but are notlimited to, Microsoft™ Word™, Excel™ and PowerPoint™, RTF, PDF and plaintext.

In certain embodiments, where the case data visualization application isa mobile format, the case data visualization application can beconfigured to execute on a mobile device, such as a mobile phone or asmartphone (e.g., Apple iPhone® or Google Android® device) or a tabletdevice (e.g., Apple iPad®).

FIG. 6 illustrates an example file library user interface 600 of a casedata visualization module, according to an embodiment of the invention.In certain embodiments, file library user interface 600 can be displayedwhen a user “clicks” on file library 544 of user interface 500illustrated in FIG. 5. According to the embodiment, file library userinterface 600 displays a view of one or more files that have beenreceived by the case data visualization application. According to theillustrated embodiment of FIG. 6, file library user interface 600includes file filter 610. File filter 610 can filter the files that aredisplayed within file library user interface 600. In certainembodiments, file filter 610 can filter the files based on one of threefilter settings, “All,” “Attached,” and “Unattached.” When file filter610 filters the files based on the filter setting “All,” all the filesthat have been received by the case data visualization application aredisplayed within file library user interface 600. When file filter 610filters the files based on the filter setting “Attached,” only filesthat have been associated with an event are displayed within filelibrary user interface 600. When file filter 610 filters the files basedon the filter setting “Unattached,” only files that have not beenassociated with an event are displayed within file library userinterface 600. In certain embodiments, each file can be associated withmore than one event.

According to the embodiment, file library user interface 600 includesfile view 620. File view 620 can control the view that is used todisplay the files within file library user interface 600. In certainembodiments, file view 620 can select one of two views: “Normal” and“Forensic.” The “Normal” view displays a list of the files received bythe case data visualization application. The “Forensic” view displays alist of the files, where the files are categorized by their forensichash. In other words, two or more files with identical forensic hashesare grouped within a single category.

According to the illustrated embodiment of FIG. 6, file library userinterface 600 also includes the following fields: file name 630, events640, size 650, and create date 660. For each file, file name 630displays the file name, events 640, displays the number of events thatthe file is associated with, size 650 displays the size of the file, andcreate date 660 displays the date the file was created. In certainembodiments, where a user “clicks” on a number of events that the fileis associated with, displayed within events 640, file library userinterface 600 displays a list of events that the file is associated with(not shown in FIG. 6). In some of these embodiments, by “clicking” onone of the events within the list of events, detail band 510 of userinterface 500 of FIG. 5 navigates to the event and displays the event(not shown in FIG. 6). As previously described, in certain embodiments,a case data visualization application can automatically forensicallyhash each received file. Thus, the case data visualization applicationcan determine that a received file is identical to a file that hasalready been received. In these embodiments, rather storing the receivedfile a second time, the case data visualization application can createmetadata that references the file that has already been received, andcan store the metadata, rather than the received file.

In the illustrated embodiment, file library user interface 600 displaysthree files, files 670, 680, and 690. File library user interface 600further displays the name of the file, the number of events that thefile is associated with, the size of the file and the date the file wascreated, for each file of files 670, 680, and 690. However, one ofordinary skill in the art would readily appreciate that this is merelyan example embodiment, and that in alternate embodiments, file libraryuser interface 600 can display any number of files.

FIG. 7 illustrates a block diagram of a case data visualizationapplication in a mobile format in accordance with an embodiment of theinvention. According to the embodiment, a device 700 can include a casedata visualization application 710 that is a mobile format, where thecase data visualization application 710 is implemented on device 700. Insome embodiments, device 700 is a mobile device, and in otherembodiments, device 700 is a tablet device. Case data visualizationapplication 710 can further generate case data. Examples of case datacan include image data, audio data, video data, visualization data,geospatial data, or document data. For example, case data visualizationapplication 710 can interface with a camera stored within device 700 andcollect one or more images or videos. Each image or video can be storedin an image file or video file respectively. As another example, casedata visualization application 710 can interface with a globalpositioning system (“GPS”) receiver stored within device 700 and collectgeospatial data, where the geospatial data can be recorded as metadatafor collected files. As yet another example, case data visualizationapplication 710 can generate a digital document, where the digitaldocument can be stored in a document file. Case data visualizationapplication 710 can then transmit the generated case data to anotherdevice, such as a client or server.

According to certain embodiments, case data visualization application710 can encrypt the case data before it is transmitted to anotherdevice. Also, in certain embodiments, case data visualizationapplication 710 can automatically forensically hash the case data uponcreation time.

According to certain embodiments, case data visualization application710 can transmit the case data in one of several ways. In someembodiments, case data visualization application 710 can transmit thecase data wirelessly over an encrypted channel. In other embodiments,case data visualization application 710 can establish a point-to-pointconnection with the other device and transmit the case data over thepoint-to-point connection. In certain embodiments, the point-to-pointconnection can be a peer-to-peer wireless connection. In theseembodiments, the peer-to-peer connection can be established using a zeroconfiguration network discovery protocol. As one of ordinary skill inthe art would readily appreciate, a zero configuration network discoveryprotocol is a protocol that allows one device to locate and connect toanother device automatically, without manually configuring eitherdevice's network settings. Also, in these embodiments, an authenticationmechanism can be required to establish the point-to-point connection.For example, case data visualization application 710 can transmit anauthentication key (such as a personal identification number) to theother device. A user can be required to enter the authentication keywithin a user interface of the other device, before case datavisualization application 710 will initiate the transfer of the casedata over the peer-to-peer connection.

In other embodiments, case data visualization application 710 can storethe case data within a file, where the file can be physicallytransferred to the other device, and synchronized with any case datastored within the other device. In yet other embodiments, case datavisualization application 710 can store the case data on a network,where the other device can fetch the case data from the network.

In certain embodiments, where the case data visualization application isa server format, the case data visualization application can facilitatecollaboration on cases.

FIG. 8 illustrates a block diagram of a case data visualizationapplication in a server format in accordance with an embodiment of theinvention. According to the embodiment, a server 800 can include a casedata visualization application 810 that is a server format, where thecase data visualization application 810 is implemented on device 800.According to the embodiment, case data visualization application 810 canfacilitate collaboration on cases. More specifically, case datavisualization application 810 can “publish” case data associated with acase, so that other users (using a device that includes a client formatof the case data visualization application, such as devices 820 and 830)can access the case data. Other users can access the case data bydownloading the case data using a device that includes the client formatof the case data visualization application (such as devices 820 and830). Through this collaboration, changes to cases can propagate toother users. In other embodiments, case data visualization application810 can act as gateway, where the case data visualization applicationcan connect to other products, services, or capabilities.

Also in certain embodiments, case data visualization application 810 cansynchronize a received set of case data with a stored set of case datathat is stored within case data visualization application 810. Case datavisualization application 810 can synchronize the two sets of data sothat other users can view changes to the case data included in thereceived set of case data. Thus, during synchronization, case datavisualization application 810 can reconcile differences between thereceived set of case data and the stored set of case data. In someembodiments, the received set of case data has a different format thanthe stored set of case data. In these embodiments, duringsynchronization, case data visualization application 810 can firsttransform the received set of case data into the format of the storedset of case data before reconciling the differences. For example, thereceived set of case data may originally have a SQLite format, thestored set of case data may have a MongoDB format, and case datavisualization application 810 can transform the received set of casedata so that the received set of case data can also have a MongoDBformat.

Thus, according to certain embodiments, a client format of the case datavisualization application can disconnect from case data visualizationapplication 810, go offline, reconnect with case data visualizationapplication 810, and can synchronize its case data with the case data ofcase data visualization application 810, where case data visualizationapplication 810 facilitates the synchronization. The advantage of thistype of synchronization mechanism is that no connectivity of the clientformat of the case data visualization application is assumed. Instead, auser can work on a case file using a first client format of the casedata visualization application, the case file can be moved from onephysical location to another physical location, loaded onto a secondclient format of the case data visualization application, and can besynchronized with case data visualization application 810.

In certain embodiments, synchronization is initiated manually by a user.In other embodiments, synchronization is automatically initiated. Incertain embodiments, case data visualization application 810 can storecase data within a NoSQL database, such as a MongoDB database.

According to certain embodiments, case data visualization application810 can facilitate coordination of case data with another case datavisualization application. According to the embodiments, a case datavisualization application for a first organization (such as case datavisualization application 810) can distill criteria (such as a set ofsearch terms and/or tags) into a criteria file. The criteria file can beloaded into a case data visualization application for a secondorganization (such as a case data visualization application implementedon device 820 or device 830). The case data visualization applicationfor the second organization can correlate criteria distilled within thecriteria file with case data stored within the case data visualizationapplication for the second application. The correlation can produce oneor more correlation results. Correlation results from the correlationcan be filtered by the case data visualization for the secondorganization to remove any personal or confidential information. Thefiltered correlation results can be displayed within a user interface orstored within a file. For example, the filtered correlation resultscould include a list of one or more contacts, where each contact isassociated with case data, but the case data is filtered, so that onlycontact information is returned.

FIG. 9 illustrates a method according to an embodiment of the invention.The steps of each method and algorithm described in connection with theembodiments disclosed herein may be embodied directly in hardware, in acomputer program executed by a processor, or in a combination of thetwo. A computer program may be embodied on a computer-readable medium,such as a storage medium. For example, a computer program may reside inRAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, a removabledisk, a CD-ROM, or any other form of storage medium known in the art. Anexemplary storage medium may be coupled to the processor such that theprocessor can read information from, and write information to, thestorage medium. In the alternative, the storage medium may be integralto the processor. The processor and the storage medium may reside in anapplication specific integrated circuit (ASIC). In the alternative, theprocessor and the storage medium may reside as discrete components.

The flow begins and then proceeds to step 910. At step 910, a timelineis displayed that includes one or more events associated with a case.The one or more events can be displayed within the timeline in achronological order. In certain embodiments, each event of the one ormore events is associated with a date and/or time. In certainembodiments, at least one event is associated with a timespan. Also, incertain embodiments, the one or more events can be displayed along thetimeline using a stacking algorithm. A stacking algorithm displays twoevents in a horizontal direction when a duration amount between the twoevents is greater than or equal to a predetermined amount. The stackingalgorithm also displays two events in a horizontal direction and avertical direction when the duration amount between the two events isless than the predetermined amount. In certain embodiments, the case canbe a prosecution of a criminal defendant. Also, in certain embodiments,the case data can include at least one of image data, audio data, videodata, visualization data, geospatial data or document data. The flowthen proceeds to step 890.

At step 920, a new event is created that is associated with the case. Incertain embodiments, summary information can also be associated with theevent. Summary information can include at least one of a date and/ortime, or a title. The flow then proceeds to step 930.

At step 930, one or more files are received, where at least one fileincludes new case data. New case data is case data that is not part ofthe case data included with the one or more events that are displayedwithin the timeline. In certain embodiments, the new case data caninclude at least one of image data, audio data, video data,visualization data, geospatial data or document data. Also in certainembodiments, the one or more files are selected from a user interfacethat can be displayed, where the user interface allows one or more filesthat are stored on a device to be selected. In these embodiments, afolder can also be selected from the user interface, where the folderincludes the one or more files. The flow then proceeds to step 940.

At step 940, the one or more files are encapsulated within a case file.In certain embodiments, a case file is created, where the case file is afile that is associated with the case, that has a specifically definedformat, and that includes case data. In these embodiments, the one ormore files are stored within the case file. In certain embodiments, thespecifically defined format is a SQLite file format. Also, in certainembodiments where at least one file is identical to a file that isalready stored within the case filed, metadata associated with the atleast file is generated and stored within the case file. The flow thenproceeds to step 950.

At step 950, the new event is displayed within the timeline. Thedisplayed new event can include a link to the case file, where the linkto the case file causes the new case data to be displayed within thetimeline. The flow then ends.

In certain embodiments, the method illustrated in FIG. 9, or any othermethod described herein, includes one or more additional optional steps.In some embodiments, the one or more files can be automaticallyforensically hashed. The automatic forensic hashing can include hashingeach file to produce a digital signature and embedding the digitalsignature within the file. In other embodiments, the one or more filescan be encrypted. In some embodiments, one or more tags can beassociated with the new event. In other embodiments, one or moretimespan events can also be associated with the case.

In certain embodiments, the case file can be stored within a SQLitedatabase. In other embodiments, the display of the timeline can beswitched to a view of one or more case files associated with the one ormore events. In some embodiments, an ability to edit the case datadisplayed within the timeline can be disabled. In other embodiments, thecase data can be generated, where the case data comprises at least oneof, image data, audio data, video data, visualization data, geospatialdata, or document data.

In certain embodiments, the case data can be transmitted to a device. Insome of these embodiments, the case data can be transmitted over anencrypted channel. In other of these embodiments, the case data can betransmitted over a peer-to-peer wireless connection.

In certain embodiments, at least one search term or tag can be storedwithin a criteria file. This criteria file can then be correlated withcase data stored within an application. The correlation can produce oneor more correlation results. Correlation results from the correlationcan be filtered by the case data visualization for the secondorganization to remove any personal or confidential information.

FIG. 10 illustrates another method, according to an embodiment of theinvention. The flow begins and then proceeds to step 1010. At step 1010,a first set of case data associated with a case is received. The firstset of case data includes a first set of events associated with thecase. The flow then proceeds to step 1020. At step 1020, the first setof case data is compared with a second set of case data associated withthe case, wherein the second set of case data includes a second set ofevents associated with the case. The flow then proceeds to step 1030. Atstep 1030, one or more differences between the first set of case datawith the second set of case data are reconciled. The flow then ends.

In certain embodiments, the reconciliation of the one or moredifferences is initiated by a user. In these embodiments, the user canselect how to reconcile the differences. For example, the user canselect to retain the first set of case data for all differences. Asanother example, the user can select to retain the second set of casedata for all differences. As yet another example, the user can select toretain either the first set of case data or the second set of case dataon a difference-by-difference basis for each difference. In otherembodiments, the reconciliation is automatic, where the automaticreconciliation is based on one or more pre-defined conditions. In someembodiments, the first set of case data is stored in a SQLite database,and the second set of case data is stored in a NoSQL database. In someof these embodiments, the NoSQL database is a MongoDB database. Incertain embodiments, the first set of case data is in a first format,the second set of case data is in a second format, and the first formatof the first set of case data can be transformed into the second format.

FIG. 11 illustrates an example of a project editor user interface 1100,which may be used in conjunction, for example, with user interface 500of the case data visualization module. In particular, in an embodiment,project editor user interface 1100 may be configured to create a projectthat comprises a snapshot of detail band 510 (i.e., a snapshot of atimeline), where one or more events that are associated with the caseare displayed along the timeline. In one embodiment, the project can beedited and exported in a variety forms, such as presentations orreports. Since the projects are based on information already organizedwithin the timeline, this embodiment may greatly reduce the time andeffort spent compiling presentations or reports based on the timeline.

When a project is created via project editor user interface 1100, thecreated project is based on a current view of the timeline. In otherwords, the project is made up of a subset or snapshot of the timelinethat is currently displayed in detail band 510. For example, if thetimeline view is filtered to a specific set of tags, then the projectcan be created with just those events as a starting point. This may beuseful for creating presentations based on a specific facet of the case.

As illustrated in the example of FIG. 11, project editor user interface1100 includes an outline view 1110 that displays an outline view of allevents in the case. In an embodiment, the subset of events that will beincluded in the project are already highlighted. In the example of FIG.11, Event #2 and Event #4 are highlighted, thereby indicating that thoseevents are already included in the project. All the information for theevents included in a project are prepopulated from the timeline. Also,in an embodiment, any changes made to the events or associatedinformation within a project do not flow back into a case file. As aresult, the details can be tailored to the specific requirements of aproject without concern about those changes affecting or changing a casefile. As illustrated in FIG. 11, project editor user interface 1100 mayfurther include a preview pane 1160 which displays a preview of theproject which can show how it will look when exported as an interactivemultimedia presentation. Project editor user interface 1100 may alsoinclude an event title pane 1120, a subheading pane 1130, files pane1140, and event summary pane 1150. Project editor user interface 1100allows a user to add, reorder, or hide events in order to best tell thestory behind the project.

According to certain embodiments, project editor user interface 1100 isfurther configured to export a created project into various formats orfiles, such as browser-based presentations or reports. Thesepresentations or files can be exported to a local or remote computer ordevice, and viewed offline or uploaded to a website, if desired.Additionally, project editor user interface 1100 allows a user to changethe visual appearance of the presentation or report, for example byapplying different themes or backgrounds. In another embodiment, theoutput type of a project can be changed to just a text format, such asRTF, that can be opened in any word processor. In other embodiments, theproject can be exported as a CSV file that can be opened as aspreadsheet or imported into a database, for example.

FIG. 12 illustrates a method according to another embodiment of theinvention. The steps of each method and algorithm described inconnection with the embodiments disclosed herein may be embodieddirectly in hardware, in a computer program executed by a processor, orin a combination of the two. A computer program may be embodied on acomputer-readable medium, such as a storage medium. For example, acomputer program may reside in RAM, flash memory, ROM, EPROM, EEPROM,registers, hard disk, a removable disk, a CD-ROM, or any other form ofstorage medium known in the art. An exemplary storage medium may becoupled to the processor such that the processor can read informationfrom, and write information to, the storage medium. In the alternative,the storage medium may be integral to the processor. The processor andthe storage medium may reside in an application specific integratedcircuit (ASIC). In the alternative, the processor and the storage mediummay reside as discrete components.

The flow begins and then proceeds to step 1210. At step 1210, a timelineis displayed that includes one or more events associated with a case.The one or more events can be displayed within the timeline in achronological order. In certain embodiments, each event of the one ormore events is associated with a date and/or time. In certainembodiments, at least one event is associated with a timespan. Also, incertain embodiments, the one or more events can be displayed along thetimeline using a stacking algorithm. A stacking algorithm displays twoevents in a horizontal direction when a duration amount between the twoevents is greater than or equal to a predetermined amount. The stackingalgorithm also displays two events in a horizontal direction and avertical direction when the duration amount between the two events isless than the predetermined amount. In certain embodiments, the case canbe a prosecution of a criminal defendant. Also, in certain embodiments,the case data can include at least one of image data, audio data, videodata, visualization data, geospatial data or document data. The flowthen proceeds to step 1220.

At step 1220, a new event is created that is associated with the case.In certain embodiments, summary information can also be associated withthe event. Summary information can include at least one of a date and/ortime, or a title. The flow then proceeds to step 1230.

At step 1230, one or more files are received, where at least one fileincludes new case data. New case data is case data that is not part ofthe case data included with the one or more events that are displayedwithin the timeline. In certain embodiments, the new case data caninclude at least one of image data, audio data, video data,visualization data, geospatial data or document data. Also in certainembodiments, the one or more files are selected from a user interfacethat can be displayed, where the user interface allows one or more filesthat are stored on a device to be selected. In these embodiments, afolder can also be selected from the user interface, where the folderincludes the one or more files. The flow then proceeds to step 1240.

At step 1240, the one or more files are encapsulated within a case file.In certain embodiments, a case file is created, where the case file is afile that is associated with the case, that has a specifically definedformat, and that includes case data. In these embodiments, the one ormore files are stored within the case file. In certain embodiments, thespecifically defined format is a SQLite file format. Also, in certainembodiments where at least one file is identical to a file that isalready stored within the case filed, metadata associated with the atleast file is generated and stored within the case file. The flow thenproceeds to step 1250.

At step 1250, the new event is displayed within the timeline. Thedisplayed new event can include a link to the case file, where the linkto the case file causes the new case data to be displayed within thetimeline. At step 1260, a project may be created, for example using theproject editor user interface 1100 depicted in FIG. 11. The createdproject may include a snapshot or subset of events from a timeline. At1270, the project may be exported into a browser-based presentation orreport. The flow then ends.

Another embodiment is directed to creating a storyline, which is aninteractive narrative, directly within the case data visualizationapplication. For example, a storyline may provide a guided walk-throughof a particular aspect of a case within the case data visualizationapplication, while allowing the freedom to diverge from that particularaspect to explore other items or events of interest. For instance, astoryline can be created to provide a structured briefing of one or moreevents and associated information within a timeline of the case datavisualization application.

In one embodiment, each storyline is made up of individual scenes, whereeach scene is a snapshot of the state of the timeline when that scenewas created. In certain embodiments, a storyline palette may bedisplayed within the case data visualization application. The storylinepalette includes various functions allowing a user to create, modify,revise or delete scenes from a storyline.

According to an embodiment, in order to create a new scene for astoryline, the user may arrange the timeline appropriately for thescene, for example by changing tag filters or changing the scale of thetimeline, and then click on an add scene button on the storyline palette(e.g., “+” button). This will append a new scene to the storyline, wherethe new scene is associated with the currently viewed start and endtimes on the timeline, as well as any tag filters or search values.Using the storyline palette, the newly created scene can be named and acaption can be added. The caption is displayed when the scene isactivated or selection. Text within the caption may provide adescription of the scene or context for the scene, for example. In anembodiment, the storyline palette may also allow for the changing orediting of an existing scene.

In certain embodiments, when a particular storyline scene is selectedfrom the timeline, a caption overlaid on the timeline may be displayed.As mentioned above, the caption may include a description of theassociated scene or may provide context for the scene. As each scenewithin a storyline is viewed, it will automatically transition or movethe timeline to display the time period, filter tags, and specificsearch terms that were saved with that scene. In an embodiment, thescenes of the storyline may be stepped through or viewed sequentially,or the storyline palette may be displayed to show the entire list ofscenes. From the storyline palette, a specific scene may be selected andviewed instantly. Existing scenes may also be reordered or deleted fromthe storyline palette.

In some embodiments, storylines are synchronized with a server so thatmultiple people, which may be located at different locations, cancollaborate to create and/or modify a storyline. During asynchronization process, if conflicts are detected, a conflictresolution dialog may be displayed to allow a user to decide how toresolve the conflict.

According to certain embodiments, a data visualization application canprovide a streamlined, intuitive, software application, that can receivedigital files and documents (such as digital photos, audio samples,scanned documents, and digital video), and organize it in a manner thatis easy to visualize. The data visualization application can also allowa user to focus on a wide band of time or a narrow band of time, and canview one or more events associated with a case, as well as theunderlying case data (such as digital files and documents) for eachevent.

One having ordinary skill in the art will readily understand that theinvention as discussed above may be practiced with steps in a differentorder, and/or with hardware elements in configurations which aredifferent than those which are disclosed. Therefore, although theinvention has been described based upon these preferred embodiments, itwould be apparent to those of skill in the art that certainmodifications, variations, and alternative constructions would beapparent, while remaining within the spirit and scope of the invention.In order to determine the metes and bounds of the invention, therefore,reference should be made to the appended claims.

We claim:
 1. A method, comprising: displaying a timeline that comprisesone or more events associated with a case, wherein the one or moreevents are displayed within the timeline in a chronological order, andwherein at least one event comprises case data; creating a new eventthat is associated with the case; receiving one or more files, whereinat least one file comprises new case data; encapsulating the one or morefiles within a case file; displaying the new event within the timeline,wherein the displayed new event comprises a link to the case file, andwherein the link to the case file causes the new case data to bedisplayed within the timeline; creating a project using a project editoruser interface, wherein the project comprises a snapshot of thetimeline; and exporting the project to a browser-based presentation fileor report file.
 2. The method of claim 1, further comprising creating astoryline comprising at least one scene to produce an interactivenarrative of an aspect of the case.
 3. The method of claim 2, wherein,when the at least one scene is selected, the method further comprisesdisplaying a caption comprising a description of the at least one scene.4. The method of claim 1, wherein the encapsulating the one or morefiles further comprises storing the one or more files within the casefile.
 5. The method of claim 4, where the encapsulating the one or morefiles further comprises generating metadata associated with at least onefile of the one or more files when the at least one file is identical toa file that is stored within the case file.
 6. The method of claim 1,wherein the displaying the timeline further comprises displaying the oneor more events along the timeline using a stacking algorithm, where thestacking algorithm displays two events in a horizontal direction when aduration amount between the two events is greater than or equal to apredetermined amount, and where the stacking algorithm displays twoevents in a horizontal direction and a vertical direction when theduration amount between the two events is less than the predeterminedamount.
 7. The method according to claim 1, further comprisingassociating one or more tags with the new event.
 8. The method accordingto claim 1, further comprising displaying one or more timespan eventsassociated with the case.
 9. The method according to claim 1, furthercomprising encrypting the one or more files.
 10. The method according toclaim 1, wherein a format of the case file comprises a SQLite fileformat.
 11. The method according to claim 1, further comprising storingthe case file within a SQLite database.
 12. The method according toclaim 1, further comprising: storing at least one search term or tagwithin a criteria file; and correlating the criteria file with case datastored within an application.
 13. The method according to claim 1,further comprising switching the display of the timeline to a view ofone or more case files associated with the one or more events.
 14. Themethod according to claim 1, further comprising disabling the ability toedit the case data.
 15. The method according to claim 1, furthercomprising generating the case data, wherein the case data comprises atleast one of, image data, audio data, video data, visualization data,geospatial data, or document data.
 16. The method according to claim 15,further comprising transmitting the case data to a device.
 17. Themethod according to claim 16, wherein the transmitting the case datafurther comprises transmitting the data over an encrypted channel. 18.The method according to claim 16, wherein the transmitting the case datafurther comprises transmitting the data over a peer-to-peer wirelessconnection.
 19. An apparatus, comprising: a memory configured to store acase data visualization module; and a processor configured to executethe case data visualization module stored on the memory; wherein theprocessor is further configured, when executing the case datavisualization module stored on the memory, to, display a timeline thatcomprises one or more events associated with a case, wherein the one ormore events are displayed within the timeline in a chronological order,and wherein at least one event comprises case data; create a new eventthat is associated with the case; receive one or more files, wherein atleast one file comprises new case data; encapsulate the one or morefiles within a case file; display the new event within the timeline,wherein the displayed new event comprises a link to the case file, andwherein the link to the case file causes the new case data to bedisplayed within the timeline; create a project using a project editoruser interface, wherein the project comprises a snapshot of thetimeline; and export the project to a browser-based presentation file orreport file.
 20. The apparatus according to claim 19, wherein theprocessor is further configured, when executing the case datavisualization module stored on the memory, to disable the ability toedit the case data.
 21. The apparatus according to claim 19, wherein theprocessor is further configured, when executing the case datavisualization module stored on the memory, to generate the case data,wherein the case data comprises at least one of, image data, audio data,video data, or geospatial data.
 22. The apparatus according to claim 20,wherein the processor is further configured, when executing the casedata visualization module stored on the memory, to transmit the casedata to a device.
 23. The apparatus according to claim 19, wherein theprocessor is further configured, when executing the case datavisualization module stored on the memory, to create a storylinecomprising at least one scene to produce an interactive narrative of anaspect of the case.
 24. The apparatus according to claim 19, wherein theprocessor is further configured, when executing the case datavisualization module stored on the memory, to display a captioncomprising a description of the at least one scene when the at least onescene is selected.
 25. A non-transitory computer-readable medium, havinga computer program stored thereon that, when executed by a processor,causes the processor to implement a method, the method comprising:displaying a timeline that comprises one or more events associated witha case, wherein the one or more events are displayed within the timelinein a chronological order, and wherein at least one event comprises casedata; creating a new event that is associated with the case; receivingone or more files, wherein at least one file comprises new case data;encapsulating the one or more files within a case file; displaying thenew event within the timeline, wherein the displayed new event comprisesa link to the case file, and wherein the link to the case file causesthe new case data to be displayed within the timeline; creating aproject using a project editor user interface, wherein the projectcomprises a snapshot of the timeline; and exporting the project to abrowser-based presentation file or report file.